fix(server): Do not send X-Forwarded-* headers via proxy

resolves #4635
hslayers · Jan 31, 2024 · 78411fb · 78411fb
1 parent b8a2e16
commit 78411fb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/projects/hslayers-server/src/proxy.js b/projects/hslayers-server/src/proxy.js
@@ -21,6 +21,8 @@ const cors_proxy = cors_anywhere.createServer({
       secureOptions: 1 << 2,
     },
   },
+  // Remove X-Forwarded-* headers since some map servers (ArcGIS) use it to generate URLs in capabilities and 'xfwd' option does not guarantee that
+  removeHeaders: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-site', 'x-forwarder-server']
 });
 const GEONAMES_APIKEY = process.env.HS_GEONAMES_API_KEY || 'hslayersng';